package unrestrictedupload;

import com.sun.jersey.core.header.FormDataContentDisposition;
import com.sun.jersey.multipart.FormDataParam;
import java.io.File;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.nio.file.FileAlreadyExistsException;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.activation.MimetypesFileTypeMap;
import javax.ws.rs.Consumes;
import javax.ws.rs.GET;
import javax.ws.rs.POST;
import javax.ws.rs.Path;
import javax.ws.rs.PathParam;
import javax.ws.rs.Produces;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.Response;
import sqlinjection.UserService;


/**
 *
 * @author Zbyszko
 */
@Path("/uploadService")
public class UploadService {
    
    private static final String PATH = "C:\\xampp\\htdocs\\filestore\\";
    
    @POST
    @Path("/uploadAndShow")
    @Consumes(MediaType.MULTIPART_FORM_DATA)
    @Produces("application/json")
    public Response uploadAndShow(@FormDataParam("file") InputStream in, 
        @FormDataParam("file") FormDataContentDisposition info) throws FileAlreadyExistsException, Exception{
        
        String path = PATH + info.getFileName();
        File file = new File(path);
        
        if(file.exists()) {
            throw new FileAlreadyExistsException(file.getName());
        }
        
        if(! (file.getName().endsWith(".json"))) {
            throw new Exception("This is not json file...");
            
        }
        
        System.out.println("Mime Type of " + file.getName() + " is " +
                         new MimetypesFileTypeMap().getContentType(file));
        try {
            OutputStream out = new FileOutputStream(file);
            int read = 0;
            byte[] bytes = new byte[1024];
            while((read = in.read(bytes)) != -1) {
                out.write(bytes, 0, read);
            }
            
            out.flush();
            out.close();
            
        } catch (FileNotFoundException ex) {
            Logger.getLogger(UploadService.class.getName()).log(Level.SEVERE, null, ex);
        } catch (IOException ex1) {
            Logger.getLogger(UploadService.class.getName()).log(Level.SEVERE, null, ex1);
        }
        //Response.temporaryRedirect(null)
        return Response.ok("File has been uploaded.").build();
    }
    
    //Nie ma @Produces i if'a ze sprawdzaniem rozszerzenia
    @POST
    @Path("/uploadAndShow_Vulnerable")
    @Consumes(MediaType.MULTIPART_FORM_DATA)
    //@Produces("text/plain")
    public Response uploadAndShow_Vulnerable(@FormDataParam("file") InputStream in, 
        @FormDataParam("file") FormDataContentDisposition info) throws FileAlreadyExistsException, Exception{
        
        String path = PATH + info.getFileName();
        File file = new File(path);
        
        if(file.exists()) {
            throw new FileAlreadyExistsException(file.getName());
        }
              
        try {
            OutputStream out = new FileOutputStream(file);
            int read = 0;
            byte[] bytes = new byte[1024];
            while((read = in.read(bytes)) != -1) {
                out.write(bytes, 0, read);
            }
            
            out.flush();
            out.close();
            
        } catch (FileNotFoundException ex) {
            Logger.getLogger(UploadService.class.getName()).log(Level.SEVERE, null, ex);
        } catch (IOException ex1) {
            Logger.getLogger(UploadService.class.getName()).log(Level.SEVERE, null, ex1);
        }
        return Response.ok("The file has been uploaded.").build();
    }
     
}  